Genesys Cloud - Developer Announcements!

Summary

The annual rotation of the Web Services Data Action DigiCert mTLS client certificates will begin on or after August 31, 2026.

The upcoming DigiCert mTLS client certificate is available in each region through the following endpoint:

GET /api/v2/integrations/actions/certificates

Customers can retrieve the upcoming certificate in advance to prepare their environments for the certificate rotation.

Effective Date

Monday, August 31, 2026

Details

The DigiCert mTLS client certificate used by Web Services Data Actions is rotated annually as part of the certificate lifecycle management process.

Customer Impact

Web Services Data Action integrations configured to use the DigiCert mTLS certificate will automatically begin using the new client certificate during the rotation period.

Customers whose endpoints authenticate incoming client certificates must ensure they trust both the current and upcoming DigiCert mTLS certificates before the rotation begins.

If customer endpoints are not configured to trust the new certificate, they will reject connections from the Web Services Data Action service once the rotation occurs.

Customer Action Required

Customers using DigiCert mTLS with Web Services Data Actions should:

• Retrieve the upcoming client certificate using:GET /api/v2/integrations/actions/certificates

• Configure their endpoints to trust both the current and upcoming DigiCert mTLS certificates before August 31, 2026.

• Verify that mTLS connections continue to succeed after the certificate rotation.

Impacted Resources

• GET /api/v2/integrations/actions/certificates
• POST /api/v2/integrations/actions/{actionId}/execute
• POST /api/v2/integrations/actions/{actionId}/draft/test
• POST /api/v2/integrations/actions/{actionId}/test

Issue References

PEZ-11506

PEZ-11483

PEZ-11485

Contacts

Please reply to this announcement with any questions. This helps the wider developer community benefit from the discussion. We encourage you to use this thread before contacting the designated person directly. Thank you for your understanding.

Hi,

Is the certificate rotation performed at a specific date/time per region, or can it occur at any time starting August 31, 2026? Is there a published rotation window for SAE1?

By far the best approach is have support in place for both certificates for a month starting August 31st. Our global deploy process is complex, so the day of the deploy  to the SAE-1 region can vary somewhat, and more importantly, if that deploy has a defect it is possible that the deploy would be rolled back.

Having a month of support for both certificates ensures that even if we have to rollback the certificate update and deploy it again later your data actions will not be impacted.

------------------------------
--Jason
------------------------------

Hi @Jason Mathison.

Thank you for the information and your attention.

Hi Jhonatan

i opened a case at genesys care, and I received answer that the rotation will occur at aug/31. At operational console it is possible to get the integratons that will be affected. Using the api its is possible to get the new upcoming digicert certificate.

Here we already start deploying the new DigiCert certificate at apis gateways.

Its our first digicert rotation.So aug/31 will be a great day.... 

kleber Koti

We do see upcoming cert is using same intermediate and root as previous cert. Do we still need to trust the upcoming cert?

That is completely up to the configuration of whatever is doing TLS termination.

Thank you!

Hi,

1. Genesys needs to send leaf + intermediate in the handshake (we only hold the root). Works today, but bundles get rebuilt during rotations?

2. We forward the cert Subject DN to origin as X-eBay-Client-Cert. New cert has L=Menlo Park vs current L=MENLO PARK - CN is identical, but if origin does a case-sensitive DN match it'll fail there even though Akamai passes.

3. Also the file has a third cert signed by Genesys's own private root - that one isn't in our truststore, anything to be done there?

Thanks

1. Our service always includes both leaf and intermediate certificates when it connects to your endpoint, and the certificate endpoint returns both certificates for both the current and upcoming certificates. Can you clarify what you are asking for?
2. The RFC has this for comparisons of DNs: Conforming implementations MUST support name comparisons using caseIgnoreMatch. in https://www.rfc-editor.org/info/rfc5280/#section-7.1

3. If you are using the Digicert mTLS certificate then the Genesys private root is irrelevant. We suggest using the private root and certificates since it generally removes all friction for certificate rotation, however we understand that approach is not allowed by some security standards and industries.